From: Eric Biggers <ebiggers@kernel.org>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: linux-integrity@vger.kernel.org, Stefan Berger <stefanb@linux.ibm.com>
Subject: Re: [PATCH 0/3] ima: add regular file data hash support for sigv3
Date: Mon, 30 Mar 2026 13:16:35 -0700 [thread overview]
Message-ID: <20260330201635.GF4303@sol> (raw)
In-Reply-To: <20260324203929.2475782-1-zohar@linux.ibm.com>
On Tue, Mar 24, 2026 at 04:39:26PM -0400, Mimi Zohar wrote:
> IMA signature version 3 (sigv3) support was introduced to avoid file
> signature ambiguity. Instead of directly signing a raw fs-verity hash,
> IMA signs the hash of ima_file_id structure, containing the type of
> signature, the hash algorithm, and the hash.
>
> Pure ML-DSA calculates and signs the hash directly rather than a
> pre-hashed digest. To avoid ML-DSA having to re-calculate the file data
> hash, Eric Biggers suggested signing the smaller ima_file_id structure.
>
> This patch set adds the sigv3 support for regular file data hashes. A
> subsequent patch set will add the ML-DSA support.
This explanation is a bit confusing, since this is actually needed
regardless of ML-DSA support.
Anyway, it's still the right thing to do.
Acked-by: Eric Biggers <ebiggers@kernel.org>
- Eric
next prev parent reply other threads:[~2026-03-30 20:17 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-24 20:39 [PATCH 0/3] ima: add regular file data hash support for sigv3 Mimi Zohar
2026-03-24 20:39 ` [PATCH 1/3] ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures Mimi Zohar
2026-03-30 20:13 ` Eric Biggers
2026-04-05 9:46 ` Mimi Zohar
2026-03-24 20:39 ` [PATCH 2/3] ima: add regular file data hash signature version 3 support Mimi Zohar
2026-03-24 20:39 ` [PATCH 3/3] ima: add support to require IMA sigv3 signatures Mimi Zohar
2026-03-25 0:15 ` [PATCH 0/3] ima: add regular file data hash support for sigv3 Stefan Berger
2026-03-30 20:16 ` Eric Biggers [this message]
2026-04-27 12:57 ` Kamlesh Kumar
2026-04-27 13:30 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260330201635.GF4303@sol \
--to=ebiggers@kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=stefanb@linux.ibm.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.